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DETAILED ACTION 

This Office Action is in response to the communication filed on 05/02/2008. 
Claims 9-10, 30, and 51 have been cancelled. 

Claims 1, 22, and 43 have been amended. 

Claims 1-8, 1 1-29, 31-50, and 52-63 have been examined and are pending. 

Response to Arguments 

Applicant's amendment, filed 05/02/2008, with respect to the 35 U.S.C. 101 rejection of 
claims 1-8, 11-21, 22-29, and 3 1-42 have been fully considered and they are not persuasive. The 
newly amended claims 1 and 22 with means-plus-function do not overcome 35 U.S.C. 101 
rejection. 

The language in claim 1 raises an issue because the claim is directed merely to software 
modules (i.e. a control unit, a reporting unit to collect information) and means-plus-function. The 
system for controlling computer access in claim 1 does not have physical hardware components. 
There is no actual physical of component for a control unit and a report unit of the system. There 
are GUIs setting specified by an administrator and collecting information from a user that are not 
tied to an article of manufacture which would result in a practical application producing a 
concrete, useful, and tangible result to form the basic of statutory subject matter under 35 U.S.C. 
101. 

A paragraph [0039] of the specification recites as the following: 
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"[0039] The access control unit 155 of one embodiment can be implemented in software, 
firmware, hardware, or a combination thereof. Preferably, the access control unit 155 is 
implemented in software, as an executable program, and is executed by a special or general- 
purpose digital computer 106, such as a personal computer, workstation, minicomputer, or 
mainframe computer. In various embodiments, the access control unit 155, as software, is 
downloaded from the Internet by the general-purpose computer 106 and subsequently installed 
on the general-purpose computer 106. In some other embodiments, the access control unit 155, 
is provided via computer disks, computer cards, or other file-storage devices, or is pre-installed 
on the general-purpose computer 106. " 

The access control unit 155 of one embodiment can be implemented in software, 
firmware, hardware, or a combination therefore. 

The claim language does not specify to implement in hardware. Therefore, it can be 
implemented in software. The claimed invention is directed to non-statutory subject matter. 
Claim 1 should be rewritten to cover hardware only. 

Regard to claim 22, please see the same argument as described in claim 1 above. Claim 
22 should be rewritten to cover hardware only. 

Claims 2-8 and 11-21 are rejected due to virtual dependency of claim 1. 

Claims 23-29 and 31-42 are rejected due to virtual dependency of claim 22. 

Therefore, the 35 U.S.C. 101 rejection of claims 1-8, 11-21, 22-29, and 31-42 are 
maintained. 
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Applicant's arguments, filed 05/02/2008, with respect to the 35 U.S.C. 1 12 first paragraph 
rejection of claims 22-29 and 3 1-42 have been fully considered and they are not are persuasive. 
The Applicant argues that there is a support for means-plus-function as the following: 

a) "specifying setting" in a paragraph [0007] . 

b) "collecting information " and "compiling information " in a paragraph [0006]. 

The Examiner respectfully disagrees with the Applicant as the following reasons: 
Per a) The paragraph [0007] of the specification mentions a phrase "specifying setting" 
in the summary. What is the structure for "specifying setting" in the specification? The 
Examiner was unable to find any information or data on how to implement "specifying setting" 
in the specification. 

Per b) The paragraph [0006] of the specification mentions a phrase "collecting 
information " and "compiling information " in the summary. What is the structure for "collecting 
information " and "compiling information " in the specification? The Examiner was unable to 
find any information or data on how to implement "collecting information " and "compiling 
information " in the specification. 

Claims 23-29 and 31-42 are rejected due to virtual dependency of claim 22. Therefore, 
the 35 U.S.C. 1 12 first paragraph of claims 22-29 and 31-42 are maintained. 

The Examiner kindly requests the Applicant to point out with specificity (i.e. column and 
line) in the specification where the structure is described supporting the means-plus-function 
limitations (emphasis added). 
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Response to Amendment 

The applicant's amendment filed 05/02/2008 necessitated the new ground(s) of rejection 
presented in this Office action. Therefore, applicant's arguments with respect to claims 1-8, 
1 1-29, 31-50, and 52-63 have been considered but are moot in view of the new ground(s) of 
rejection. 

Claim Rejections - 35 USC §101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 1-8, 11-21, 22-29, and 31-42 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject mater. 

As per claims 1-8 and 11-21: 

The language in claim 1 raises an issue because the claim is directed merely to software 
modules (i.e. a control unit, a reporting unit to collect information) and means-plus-function. The 
system for controlling computer access in claim 1 does not have physical hardware components. 
There is no actual physical of component for a control unit and a report unit of the system. There 
are GUIs setting specified by an administrator and collecting information from a user that are not 
tied to an article of manufacture which would result in a practical application producing a 
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concrete, useful, and tangible result to form the basic of statutory subject matter under 35 U.S. C. 
101. 

A paragraph [0039] of the specification recites as the following: 
"[0039] The access control unit 155 of one embodiment can be implemented in software, 
firmware, hardware, or a combination thereof. Preferably, the access control unit 155 is 
implemented in software, as an executable program, and is executed by a special or general- 
purpose digital computer 106, such as a personal computer, workstation, minicomputer, or 
mainframe computer. In various embodiments, the access control unit 155, as software, is 
downloaded from the Internet by the general-purpose computer 106 and subsequently installed 
on the general-purpose computer 106. In some other embodiments, the access control unit 155, 
is provided via computer disks, computer cards, or other file-storage devices, or is pre-installed 
on the general-purpose computer 106. " 

The access control unit 155 of one embodiment can be implemented in software, 
firmware, hardware, or a combination therefore. 

The claim language does not specify to implement in hardware. Therefore, it can be 
implemented in software. The claimed invention is directed to non-statutory subject matter. 

Claim 1 should be rewritten to cover hardware only. 

Claims 2-8 and 11-21 are rejected due to virtual dependency of claim 1. 

As per claims 22-29 and 31-42: 

The language in claim 22 raises an issue because the claim is directed merely to software 
modules (i.e. specifying settings...; controlling access...; collecting information ...; compiling 
information) and means-plus-function that are not tied to an article of manufacture which would 
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result in a practical application producing a concrete, useful, and tangible result to form the basic 
of statutory subject matter under 35 U.S.C. 101 (Please, See the same argument as described in 
claim 1 above; paragraph [0039] of the specification). 

The claim language does not specify to implement in hardware. Therefore, it can be 
implemented in software. The claimed invention is directed to non-statutory subject matter. 

Claim 22 should be rewritten to cover hardware only. 

Claims 23-29 and 31-42 are rejected due to virtual dependency of claim 22. 



Claim Rejections - 35 USC § 112 
The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

Claims 22-29 and 31-42 are rejected under 35 U.S.C. 1 12, first paragraph, as based on a 
disclosure which is not enabling. 

"means for specifying settings..", 

"means for storing a list. 

"means for collecting information. .." , 

"means for compiling . . .", 

"means for specifying in the report a duration . . .", 
"means for specifying, in the report, identification 
"means for specifying in the report the computer applications. . .", 
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"means for authorizing the respective user access to a . . .", 
"means for prohibiting the respective user access 
"means for storing the report of the respective user . . .", 
"means for updating the report with new collected 

"means for compiling the additional information . . .", critical or essential to the practice 
of the invention, but not included in the claim(s) is not enabled by the disclosure. See In re 
Mayhew, 527 F.2d 1229, 188 USPQ 356 (CCPA 1976). The Examiner was unable to find any 
information or data on how to implement means-plus-function limitations in the specification. 



Claim 22 recites, 

"means for specifying settings..", 

"means for storing a list..", 

"means for collecting information...", and 

"means for compiling ..." . 
Claim 23 recites: 

"means for specifying in the report a duration 
Claim 24 recites: 

"means for specifying, in the report, identification . . .". 
Claim 25 recites: 

"means for specifying in the report the computer applications. . .". 
Claim 26 recites: 

"means for specifying in the report the computer applications. . .". 
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Claim 28 recites: 

"means for authorizing the respective user access to a . . .". 
Claim 29 recites: 

"means for prohibiting the respective user access 
Claim 31 recites: 

"means for storing the report of the respective user 
Claim 32 recites: 

"means for updating the report with new collected 
Claim 36 recites: 

"means for compiling the additional information 
Claim 41 recites: 

"means for authorizing the respective user to have access 
Claim 42 recites: 

"means for prohibiting the respective user to have access 

Claims 23-29 and 31-42 depend on claim 22. They are rejected with the same reason. 

The Examiner kindly requests the Applicant to point out with specificity (i.e. column and 
line) in the specification where the structure is described supporting the means-plus-function 
limitations (emphasis added). 

The Office cautions the Applicant about the addition of a new subject mater to the 
specification. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1-5, 15-19, 22-26, 36-40, 43-47, and 57-61 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Beilinson et al. (US2004/0003279 Al) in view of Kruglenko (US 

2003/0217287 Al). 

As per claim 1; 

Beilinson teaches a system for controlling computer access, comprising: 

(a) a control unit installed on a computer to control access to use of the computer 
according to settings specified by an administrator for at least one user of the computer 
[Beilinson: abstract; par. [0004]; lines 9-13; par. [0048]-[0060]; par. [0051], lines 5-8; A 
parent can use sub-category 288 to set specific times during the day that a child is allowed 
to use the computer. Also, a administrator can limit an employee's allowable login hours to 
the hours that the employee regularly works], wherein the administrator can input changes to 
the settings locally to the computer and remotely from the computer on another computer to 
which the setting do not apply [Beilinson: par. [0070]; "fig. 5 is an embodiment of the system 
500 of the present invention. Group policy objects 510 which circulate around a local 
network 512 hold the user authorization settings that have been configured through the 
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system controls 514 typically through an administrator's computer 516. The local network 
512 needed to support the invention could be a traditional LAN or WAN. However, it 
could also be any communications link between two or more computers. So, to be part of 
the local network 512, a computer needs to be able to communicate with at least one other 
computer in the local network 512 and needs to be identified as part of the local network 
512 ..."]; 

(b) means for storing a list of restricted computer application [Beilinson: par. [0007]; 
computer functions include executing software application such as word processors or 
games; par. [0008]; fig. 2 par. [0041]; par. [0048-0049]; par. [0054]; a restriction 
component 214 can be used to restrict specific computer functions 226 (e.g. restricted 
computer application)]; 

(d) means for comparing the requested computer application to the list of restricted 
computer applications [Beilinson: par. [0007]; par. [0054-0055]; "Function name sub- 
category 234 is used to deny or enable a user access to computer functions"] ; 

(e) when the requested computer application is matched to the list of restricted computer 
applications, then means for prohibiting opening the window associated with the requested 
computer application, thus terminating the requested computer application [Beilinson: par. 
[0007]; par. [0054-0055]; "Function name sub-category 234 is used to deny or enable a user 
access to computer functions"]; 

(f) a reporting unit installed on the computer to collect information from the computer on 
which local computer applications the respective user is attempting to access on the computer, 
the information being compiled in a report regarding the respective user, the report being made 
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accessible to the administrator from a remote database [Beilinson: "Desired data is collected 
which can be distilled into reports on total system usage, computer function usage, function 
process time, unsuccessful computer function usage attempts and the like. The 
administrator may apply various filters to the raw data in order to generate reports 
containing only desired information.... The administrator is further provided with the 
ability to monitor a user's activity via a read-only view of a user's computer display"; par. 
[0044]; "The monitoring and auditing component 212 is used to view a user machine by the 
administrator, to collect user activity data and to generate reports"; par. [0047]; par. 
[0070]]. 

Beilinson does not explicitly teach, 

(c) means for intercepting a message for opening a window associated with a requested 
computer application, the message intercepted before receipt thereof by an operating system. 
However, Kruglendo teaches, 

(c) means for intercepting a message for opening a window associated with a requested 
computer application, the message intercepted before receipt thereof by an operating system 
[Kruglenko: par. [0056]; "A hook is a point in the message-handling mechanism where the 
message traffic is monitor in order to intercept and process certain message before they 
reach their target window procedure 306 ... The action taken by the hook procedure varies 
between types of hooks. The message may be changed, stopped altogether, or simply 
monitored"]; 

Therefore, it would have been obvious to the person of ordinary skill in the art at the time 
the invention was made to combine the system of Beilinson by including the teaching of 
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Kruglenko to provide users with a means for preventing an unsophisticated user, such as a small 
child, from access programs or resources on a computer that may allow the user to cause harm to 
a computer system by limiting access to the computer's resources to a number of predefined 
secure programs and resources [Kruglenko: abstract, par. [0001]]. 

As per claim 2: 

Beilinson further teaches the system of claim 1 , wherein the report includes a duration of 
time the respective user has accessed a particular computer application [Beilinson: abstract; 
"The invention enables an administrator to restrict a user's logon hours, logon duration, 
access to computer functions, and access to applications based on content rating"; par. 
[0006]; par. [0008]; par. [0022]; par. [0045], lines 5-9; "Reports can be generated on total 
system usage, computer function usage, function process time, unsuccessful computer 
function usage attempts and the like. Other reports could be generated, and the invention 
is not limited to the particular reports generated"]. 

As per claim 3: 

Beilinson further teaches the system of claim 1, wherein the report includes identification 
of one or more chronological times in which the respective user has accessed a particular 
computer application [Beilinson: abstract; "The invention enables an administrator to 
restrict a user's logon hours, logon duration, access to computer functions, and access to 
applications based on content rating"; par. [0006]; par. [0008]; par. [0022]; par. [0045], 
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lines 5-9; "Reports can be generated on total system usage, computer function usage, 
function process time, unsuccessful computer function usage attempts and the like. Other 
reports could be generated, and the invention is not limited to the particular reports 
generated"]. 

As per claim 4: 

Beilinson further teaches the system of claim 1 , wherein the report includes the computer 
applications the respective user is denied access to according to the settings specified by the 
administrator [Beilinson: abstract; par. [006]; "the implementation of such a system includes 
restricting a user's logon hours, logon duration, access to computer functions, and access to 
applications. In addition, the implementation of such a system includes enabling an 
administrator to temporarily restrict or extend a user's normally allowed access privileges 
as well as monitor, audit, and obtain reports of a user's computer function usage"; par. 
[009]; par. [0054], lines 7-8; par. [0057], lines 3-4; par. [0065], lines 11-13; "the 
administrator can thus easily set time of day restrictions or content rating restrictions, for 
example, and can also specify which reports, if any are desired"; par. [0063], lines 14-15; " 
a system could be denied until the day after the child's math final"]. 

As per claim 5: 

Beilinson teaches the system of claim 1, wherein the report includes the computer 
applications to which the respective user is granted access [Beilinson: abstract; par. [006]; par. 
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[009]; par. [0045]; "Reports can be generated on total system usage, computer function 
usage, function process time, unsuccessful computer function usage attempts and the like. 
Other reports could be generated, and the invention is not limited to the particular reports 
generated"; par. [0059], lines 5-6; a child's daily access to computer games can be limited 
to an amount defined by the parent; par. [0065]]. 

As per claim 15: 

Beilinson further teaches the system of claim 1 , wherein the reporting unit further 
collects additional information on which services of a designated computer application 
the respective user is attempting to access on the computer, the additional information being 
compiled in a report regarding the respective user [Beilinson: par. [0010], "Desired data is 
collected which can be distilled into reports on total system usage, computer function 
usage, function process time, unsuccessful computer function usage attempts and the like. 
The administrator may apply various filters to the raw data in order to generate reports 
containing only desired information.... The administrator is further provided with the 
ability to monitor a user's activity via a read-only view of a user's computer display"; par. 
[0044]; "The monitoring and auditing component 212 is used to view a user machine by the 
administrator, to collect user activity data and to generate reports"; par. [0047]; par. 
[0059], lines 5-6; " a child's daily access to computer games can be limited to an amount 
defined by the parent"; an additional information can be a child's daily access to computer 
games]. 
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As per claim 16: 

Beilinson further teaches the system of claim 15, wherein the report further includes a 
duration of time the respective user has accessed a particular service of the designated computer 
application [Beilinson: abstract; "The invention enables an administrator to restrict a user's 
logon hours, logon duration, access to computer functions, and access to applications based 
on content rating"; par. [0006]; par. [0008]; par. [0022]; par. [0045], lines 5-9; "Reports 
can be generated on total system usage, computer function usage, function process time, 
unsuccessful computer function usage attempts and the like. Other reports could be 
generated, and the invention is not limited to the particular reports generated"]. 

As per claim 17: 

Beilinson further teaches the system of claim 15, wherein the report further identification 
of one or more chronological times in which the respective user has accessed the particular 
service of the designated computer application [Beilinson: abstract; "The invention enables an 
administrator to restrict a user's logon hours, logon duration, access to computer functions, 
and access to applications based on content rating"; par. [0006]; par. [0008]; par. [0022]; 
par. [0045], lines 5-9; "Reports can be generated on total system usage, computer function 
usage, function process time, unsuccessful computer function usage attempts and the like. 
Other reports could be generated, and the invention is not limited to the particular reports 
generated"]. 



As per claim 18: 
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Beilinson further teaches the system of claim 15, wherein the report includes the services 
the respective user is denied access to according to the settings specified by the administrator 
[Beilinson: abstract; par. [006]; "the implementation of such a system includes restricting a 
user's logon hours, logon duration, access to computer functions, and access to 
applications. In addition, the implementation of such a system includes enabling an 
administrator to temporarily restrict or extend a user's normally allowed access privileges 
as well as monitor, audit, and obtain reports of a user's computer function usage"; par. 
[0054], lines 7-8; par. [0057], lines 3-4; par. [0065], lines 11-13; "the administrator can thus 
easily set time of day restrictions or content rating restrictions, for example, and can also 
specify which reports, if any are desired"; par. [0063], lines 14-15; " a system could be 
denied until the day after the child's math final"]. 

As per claim 19: 

Beilinson further teaches the system of claim 15, wherein the report includes the services 
the respective user is granted access to according to the settings specified by the administrator 
[Beilinson: abstract; par. [006]; par. [009]; par. [0045]; "Reports can be generated on total 
system usage, computer function usage, function process time, unsuccessful computer 
function usage attempts and the like. Other reports could be generated, and the invention 
is not limited to the particular reports generated"; par. [0059], lines 5-6; a child's daily 
access to computer games can be limited to an amount defined by the parent; par. [0065]]. 



As per claims 22-26, 36-40: 
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35 U.S.C. 1 12, sixth paragraph, has been invoked regarding claims 22-26 and 36-40. The 
claims recite "means for" plus a function. The structures corresponding to the functions given 
within claims 22-26 and 36-40 are being interpreted by the Examiner as given within paragraph 
[0048] of the instant applications specification. 

Claim 22: 

This claim has limitations that are similar to those of claim 1 with additional limitation 
(d ) means for monitoring messages from a requested computer application that are 
directed to an operating system [Kruglenko: par. [0056]; "A hook is a point in the message- 
handling mechanism where the message traffic is monitor in order to intercept and process 
certain message before they reach their target window procedure 306 ... The action taken 
by the hook procedure varies between types of hooks. The message may be changed, 
stopped altogether, or simply monitored"], thus it is rejected with the same rationale applied 
against claim 1 above. 

Claims 23-26 and 36-40 : 

Claims 23-26 and 36-40 are similar to those of claims 2-5 and 15-19 accordingly, thus it 
is rejected with the same rationale applied against claims 2-5 and 15-19 above. 



As per claims 43-47, 57-61: 
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Claims 43-47 and 57-61 are essentially the same as claims 1-5 and 15-19 accordingly 
except that it sets forth the claimed invention as a method rather a system comprising and 
rejected under the same reasons as applied above. 

Claims 6-8, 11, 20-21, 27-29, 31-32, 41-42, 48-50, 52-53, and 62-63 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Beilinson et al. (US2004/0003279 Al) in view of 
Kruglenko (US 2003/0217287 Al), and further in view of Mathew et al. (US 2004/0003071 
Al). 

As per claim 6: 

Beilinson and Kruglenko do not explicitly teach the system wherein the report is in the 
form of a web page. 

However, Mathew teaches the system wherein the report is in the form of a web page 
[Mathew: fig. 17; par. [0071]; a history summary report implemented as a Web page using 
a markup language]. 

Thus, it would have been obvious to the person of ordinary skill in the art at the time the 
invention was made to modify the system of Beilinson and Kruglenko by including teaching of 
Mathew because it would allow administrator control component is operable to track and store 
the user's allowed and blocked online action, generate a history summary report to administrator 
[Mathew, fig. 17, par. [0016]]. 
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As per claim 7: 

Mathew further teaches the system of claim 6, wherein the report provides a mechanism 
for the administrator to authorize the respective user access to a particular application to which 
the respective was previously denied access [Mathew: fig. 17, section of Blocked Web sites, 
third column; an administrator can select "Allow site"; fig. 16, box 1610 and 1612; par. 
[0078], lines 1-5 and lines 9-12]. 

As per claim 8: 

Mathew further teaches the system of claim 6, wherein the report provides a mechanism 
for the administrator to prohibit the respective user access to a particular application [Mathew: 
fig. 17, section of Visited sites, third column; an administrator can select "Block site"; fig. 
16, box 1610 and 1614; par. [0079], lines 1-10]. 

As per claim 11: 

Beilinson and Kruglenko do not explicitly teach explicitly teach the system wherein the 
reporting unit updates the report with new collected information after an occurrence of at least 
one particular computer event. 

However, Mathew teaches the system wherein the reporting unit updates the report with 
new collected information after an occurrence of at least one particular computer event 
[Mathew: fig. 5B; fig. 5C; par. [0052]; "the parental control server 204 receives the request 
resolution and update the consent database 208 with request resolution"]. 
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Thus, it would have been obvious to the person of ordinary skill in the art at the time the 
invention was made to modify the system of Beilinson and Kruglenko by including teaching of 
Mathew because it would allow administrator control component is operable to track and store 
the user's allowed and blocked online action, generate a history summary report to administrator 
[Mathew, fig. 17, par. [0016]]. 

As per claim 20: 

Beilinson and Kruglenko do not explicitly teach the system wherein the report provides a 
mechanism for the administrator to authorize the respective user access to a particular service to 
which the respective user was previously denied access. 

However, Mathew teaches the system wherein the report provides a mechanism for the 
administrator to authorize the respective user access to a particular service to which the 
respective user was previously denied access [Mathew: fig. 17, section of Blocked Web sites, 
third column; an administrator can select "Allow site"; fig. 16, box 1610 and 1612; par. 
[0078], lines 1-5 and lines 9-12]. 

Thus, it would have been obvious to the person of ordinary skill in the art at the time the 
invention was made to modify the system of Beilinson and Kruglendo by including the teaching 
of Mathew because it would allow administrator control component is operable to track and store 
the user's allowed and blocked online action, generate a history summary report to administrator 
[Mathew, fig. 17, par. [0016]]. 



As per claim 21: 
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Beilinson and Kruglenko do not explicitly teach a system wherein the report provides a 
mechanism for the administrator to prohibit the respective user access to a particular service to 
which the respective user was previously granted access. 

However, Mathew teaches a system wherein the report provides a mechanism for the 
administrator to prohibit the respective user access to a particular service to which the respective 
user was previously granted access [Mathew: fig. 17, section of Visited sites, third column; an 
administrator can select "Block site"; fig. 16, box 1610 and 1614; par. [0079], lines 1-10]. 

Thus, it would have been obvious to the person of ordinary skill in the art at the time the 
invention was made to modify the system of Beilinson and Kruglendo by including the teaching 
of Mathew because it would allow administrator control component is operable to track and store 
the user's allowed and blocked online action, generate a history summary report to administrator 
[Mathew, fig. 17, par. [0016]]. 

As per claims 27-29, 31-32, 41-42: 

35 U.S.C. 1 12, sixth paragraph, has been invoked regarding claims 27-29, 31-32 and 41- 
42. The claims recite "means for" plus a function. The structures arc corresponding to the 
functions given within claims 27-29, 3 1-32 and 4 1 -42 are being interpreted by the Examiner as 
given within paragraph [0048] of the instant applications specification. 

Claims 27-29, 32 and 41-42 are similar to those of claims 6-8, 1 1 and 20-21 accordingly, 
thus it is rejected with the same rationale applied against claims 6-8, 1 1 and 20-21 above. 
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Regard to claim 31, Beilinson, Kruglendo, and Mathew teach subject matter as 
described in claim 27. Mathew further teaches means for storing the report of the respective user 
[Mathew: par. [0009]; lines 6-8; par. [0069], line 10; a summary information is stored]. 

As per claims 48-50, 52-53, 62-63: 

Claims 48-50, 53 and 62-63 are essentially the same as claim 6-8, 1 1 and 20-21 accordingly 
except that it sets forth the claimed invention as a method rather a system comprising and 
rejected under the same reasons as applied above. 

Regard to claim 52, Beilinson, Kruglendo, and Mathew teach subject matter as 
described in claim 48. Mathew further teaches storing the report of the respective user [par. 
[0009]; lines 6-8; par. [0069], line 10; a summary information is stored]. 

Claims 12-13, 33-34, and 54-55 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Beilinson et al. (US2004/0003279 Al) in view of Kruglenko (US 2003/0217287 Al) and 
further in view of Mathew et al. (US 2004/0003071 Al), and further in view of Rowland (US 
6,405,318 Bl). 

As per claim 12: 

Beilinson, Kruglenko, and Mathew teach the system as described in claim 1 1 . 
Beilinson, Kruglenko, and Mathew do not explicitly teach a system wherein the particular 
computer event includes the respective user logging on the computer. 
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However, Rowland teaches a system wherein the particular computer event includes the 
respective user logging on the computer [Rowland: Col. 4, lines 30-38; a system monitors logs 
(record) all logins and logouts for the target host 21]. 

Thus, it would have been obvious to the person of ordinary skill in the art at the time the 
invention was made to combine the system of Beilinson, Kruglenko, and Mathew by including 
the teaching of Rowland because it would be able to detect intrusion as they are occurring or 
soon after in real-time system [Rowland, fig. 17, par. [0068], lines 1-3]. 

As per claim 13: 

Beilinson, Kruglenko, and Mathew teach the system as described in claim 1 1 . 

Beilinson, Kruglenko, and Mathew do not explicitly teach a system wherein the particular 
computer event includes the respective user logging off the computer. 

However, Rowland teaches a system wherein the particular computer event includes the 
respective user logging off the computer [Rowland: Col. 4, lines 30-38; a system monitors logs 
(record) all logins and logouts for the target host 21]. 

Thus, it would have been obvious to the person of ordinary skill in the art at the time the 
invention was made to modify the system of Beilinson, Kruglenko, and Mathew by including the 
teaching of Rowland because it would be able to detect intrusion as they are occurring or soon 
after in real-time system [Rowland, fig. 17, par. [0068], lines 1-3]. 



As per claims 33-34: 
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35 U.S.C. 1 1 2, sixth paragraph, has been invoked regarding claims 33-34. The claims 
recite "means for" plus a function. The structures are corresponding to the functions given within 
claims 33-34 are being interpreted by the Examiner as given within paragraph [0048] of the 
instant applications specification. 

Claims 33-34 are similar to those of claims 12-13 accordingly, thus they are rejected with 
the same rationale applied against claims 12-13 above. 

As per claims 54-55: 

Claims 54-55 are essentially the same as claim 12-13 accordingly except that it sets forth 
the claimed invention as a method rather a system comprising and rejected under the same 
reasons as applied above. 

Claims 14, 35, and 56 are rejected under 35 U.S.C. 103(a) as being unpatentable over Beilinson 
et al. (US2004/0003279 Al) in view of Kruglenko (US 2003/0217287 Al) further in view of 
Mathew et al. (US 2004/0003071 Al), and further in view of Terry (US 2002/0026605 Al). 

As per claim 14: 

Beilinson, Kruglenko, and Mathew teach the system as described in claim 1 1 . 
Beilinson, Kruglenko, and Mathew do not explicitly teach a system wherein the particular 
computer event includes the start up of the computer. 
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However, Terry teaches a system wherein the particular computer event includes the start 
up of the computer [Terry: par. [0051], lines 1-3; " tracking of all internal machine 
configuration profiles (start-up) in a computer unit 105 having the client application 110"]. 

Thus, it would have been obvious to the person of ordinary skill in the art at the time the 
invention was made to combine the system of Beilinson, Kruglenko, and Mathew by including 
the teaching of Terry because it would provide the ability to report in a real-time environment to 
the monitor station and the ability to record and analyze a "penetration pattern" of unknown 
program [Terry, par. [0016] and par. [0017]]. 

As per claim 35: 

35 U.S.C. 1 12, sixth paragraph, has been invoked regarding claim 35. The claims recite 
"means for" plus a function. The structures are corresponding to the functions given within claim 
35 are being interpreted by the Examiner as given within paragraph [0048] of the instant 
applications specification. 

Claim 35 is similar to those of claim 14, thus it is rejected with the same rationale applied 
against claims 14 above. 

As per claim 56: 

Claim 56 is essentially the same as claim 14 accordingly except that it sets forth the 
claimed invention as a method rather a system comprising and rejected under the same reasons 
as applied above. 
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Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

The prior arts made of record and not relied upon are considered pertinent to applicant's 
disclosure. 

US 20020091870 Al to MADL, MICHAEL THOMAS et al.; 
US 20030191865 Al to De Armas, Mario E. et al.; 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the ent a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Canh Le whose telephone number is 571-270-1380. The 
examiner can normally be reached on Monday to Friday 7:30AM to 5:00PM other Friday off. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kincaid Kristine can be reached on 571-272-4063. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Canh Le/ 

Examiner, Art Unit 2139 
July 28, 2008 
/Kristine Kincaid/ 

Supervisory Patent Examiner, Art Unit 2139 



